Project Glasswing

·17 min·1 clip

Anthropic's Claude Methos is so dangerous they won't release it publicly, but it's finding 27-year-old bugs for Apple and Cisco.

The host starts with Project Glasswing, framed as the episode's biggest story. Anthropic's latest model, Claude Methos, is described as too dangerous for public release right now. The host says Anthropic has made it available internally to major companies like Apple, Broadcom, Cisco, and CrowdStrike so those companies can harden their software first. The model has reportedly found serious vulnerabilities, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. That makes responsible disclosure the central question. The host weighs the upside of letting major companies patch before a model with this capability reaches the public, especially if attackers could turn it against software. The thread then jumps to a stolen ChatGPT conversation. The host lingers on the choice of target, wondering why a chat would be worth stealing. A new memristor chip provides the hardware detour. Made with tungsten, hafnium oxide, ceramic, and graphene, it combines processing and storage in the same unit and is said to keep working at extremely high temperatures without degradation. The episode leaves some room for doubt about whether it will become better AI hardware. Politics enters through prediction markets such as Kalshi. The host says a court has ruled that sports betting on those markets counts as swaps regulated federally by the Securities and Exchange Commission rather than as state-regulated gambling. He connects that possibility to tighter integration with the American financial system, in the same broad direction as cryptocurrency. A Trump budget brings the conversation to cuts in science, including the National Institute of Standards and many other agencies. The host argues that treating political statements as truth while cutting science and education could leave America behind China and Europe. The security rundown comes back to development machines. Enhanced endpoint protection is described as checking for AI agents, MCP servers, development environment extensions, and suspicious packages that could point to a supply-chain attack or a compromised machine. The closing item is Windows 11's addition of sudo. The host explains that one-command privilege elevation keeps every other command from running with administrator access, and notes that Linux has had the practice for years.

As heard by us

An unreleased AI model sharpens the question of who gets to patch vulnerable software first.

Project Glasswing sits at the uneasy point where AI capability begins to look like a security liability. The host frames Anthropic's Claude Methos as powerful enough to stay out of public release while selected companies, including Apple, Broadcom, Cisco, and CrowdStrike, get…

Read the full review in PlayNext →

Why you'd press play

You can hear AI vulnerability hunting stop sounding futuristic and start sounding like something companies need to patch around before everyone else gets it.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Infosec Decoded